---
title: "Retrieve login form and/or user information"
method: GET
path: "/login"
---

# Retrieve login form and/or user information

`GET /login`

## Response `200`

Login form or user information. The JSON response will always carry the csrf_token information. If the caller is logged in, then additional information is returned. This can be very useful for single-page applications where during a force refresh, all state is lost. By performing this GET, the session cookie will authenticate the user and the response will contain user information.

- DefaultJsonResponse
  - `user` object, required — By default just 'id', and 'authentication_token' are returned. However by overriding _User::get_security_payload()_ any attributes of the User model can be returned.
    - `id` integer, required — Unique user id (primary key)
    - `authentication_token` string — Token to be used in future token-based API calls.
  - `csrf_token` string — Session CSRF token

## Other responses

- `302` — Response when already logged in (non-JSON request)

## Changes

- **2019-07-23** `11c8459a5c04` — 1 breaking, 3 info
  - the response's body type changed from no type to `object` for status `200` (media type: application/json)
  - removed `#/components/schemas/DefaultJsonResponse, subschema #2` from the response body `allOf` list for the response status `200` (media type: application/json)
  - added the optional property `csrf_token` to the response with the `200` status (media type: application/json)
  - added the required property `user` to the response with the `200` status (media type: application/json)

[Change history](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/changes/login/get.md)

---

[API](https://skmtc.dev/pallets-eco/apis/flask-security-external-api.md) · [All operations](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pallets-eco/flask-security-external-api/revisions/11c8459a5c04/schema)